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SIMULATION STUDIES FOR PLANNING AN IN-FLIGHT EXPERIMENT 


TO DEFINE MANUAL GUIDANCE AND CONTROL TECHNIQUES 

FOR LARGE LAUNCH VEHICLES 

By DeLamar M. Watson, Gordon H. Hardy, 
and Glenn W. Stinnett 

Ames Research Center 


SUMMARY 


The simulator program described in this report was undertaken to define 
an in-flight experiment to evaluate manual control system concepts for Saturn 
class launch vehicles. The techniques and manual control system configura- 
tions developed in earlier studies were adapted to the uprated Saturn I, 
which was the vehicle chosen for the experiment. This report discusses the 
vehicle and manual control system configuration, the handling qualities, and 
two manual guidance display schemes. An assessment is made of the impact of 
the proposed experiment on mission reliability. 


INTRODUCTION 


The astronauts have demonstrated their ability to contribute to mission 
success by participating in the guidance and control of their spacecraft. 

During the Mercury and Gemini programs, they have shown a capability to manu- 
ally control vehicle attitude, to conduct rendezvous maneuvers, to make orbit 
changes, and to initiate and control reentry. However, during the launch 
segment of flight, the crews have not had an active manual role, rather, they 
have been primarily systems monitors. 

In a joint effort by Marshall Space Flight Center (MSFC) and Ames 
Research Center (ARC), piloted flight simulators have been used to evaluate 
manual control systems for Saturn class vehicles. The feasibility of a rate- 
augmented manual control system for the S-IC stage of the Saturn V was demon- 
strated (ref. 1) . A follow-on study showed that manual guidance to a nominal 
trajectory is feasible for the S-II and S-IVB stages (ref. 2). An extensive 
study was made of the mission reliability contribution a pilot could make by 
taking over control of the vehicle in the event of a failure in the automatic 
system (ref. 3). The results of this research indicated that a pilot, using 
a simple parallel loop, could cope with a variety of launch vehicle subsystem 
failures and that mission reliability was substantially increased. At the 
request of the Manned Spacecraft Center, a manual backup scheme based on exist- 
ing Apollo hardware was evaluated as a potential alternate to the Saturn V 
iterative guidance system (ref. 4). All of these studies pointed to the 
feasibility of manual guidance and control of large launch vehicles. 



As the feasibility of a manual mode in the control system of Saturn 
class vehicles became more firmly established, it seemed desirable to carry 
the program into an in-flight experiment phase. Accordingly, an experiment 
definition program was initiated for a specific vehicle. The uprated Saturn 
I was chosen for the study since this was thought to be the first launch 
vehicle that would be available for an experiment. The experiment definition 
program was centered on the simulation study described in this report. 

The first of four objectives of the simulation study was to adapt to the 
Saturn I the feedback configuration and filters, the displays, and the pilot 
procedures developed in the studies reported in references 1 to 3. The second 
objective was to define maneuvers that would provide maximum information 
return from the limited launch vehicle flight time. The third objective was 
to establish baseline data for comparison with flight data. A final objective 
was to establish that the addition of a manual control system to the Saturn I 
vehicle would not lower the probability of mission success. 

This report contains all the phases of mission planning that were con- 
ducted as part of the simulation study. The first section of this report pro- 
vides a framework for experiment modifications by describing the uprated 
Saturn I and its flight environment. Section two is devoted to a description 
of the simulation. Section three contains a discussion of the studies carried 
out to determine the handling qualities for each of the stages. Guidance 
studies during the first-stage flight are treated in the fourth section. The 
reliability of the manually controlled Saturn I is assessed in the concluding 
section . 


SYSTEM DESCRIPTION 


Vehicle Description 


The uprated Saturn I is a two-stage launch vehicle used to place the 
Apollo command and service modules into an earth orbit. The major parts of 
the vehicle are indicated in figure 1, from bottom to top: S-IB first stage, 

S-IVB second stage. Instrument Unit (IU) , 
and the Apollo payload. 


SPACECRAFT 
STACK 


LAUNCH 

ESCAPE 

SYSTEM 




INSTRUMENT UNIT 


| SPACECRAFT 
S-IVB STAGE .LEM 



TOTAL 
LENGTH x 
68 M (224 ft) 


Figure 1.- Saturn I vehicle configuration. 


The essential features of the S-IB stage 
are nine slim propellant tanks and eight 
engines that each produce 200,000 pounds of 
thrust. The four inboard engines are fixed. 
Each of the four outboard engines are swiveled 
in pitch and yaw by hydraulic actuators to 
provide control torques. Pitch and yaw 
motions are imparted to the vehicle by appro- 
priately swiveling all four engines. Roll 
motions are produced by swiveling the engines 
differentially. Each propellant tank is 
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baffled to prevent sloshing. Because the complete Saturn I is long and slim, 
structural bending is a significant consideration for first-stage flight. 

The S-IVB stage has a single engine. Propellant is contained in two 
tanks - liquid hydrogen in the forward tank, liquid oxygen in the aft tank. 
Because of the shape of the liquid oxygen tank (two hemispherical segments 
joined together), sloshing is a significant consideration during second-stage 
flight. Sloshing in the second -stage oxygen tank is not significant during 
the first stage of flight because of baffle rings located around the top of 
the tank. Structural bending is not a serious consideration in designing a 
control system for second-stage flight because the S-IVB is shorter and stif- 
fer than the Saturn I and operates above the atmosphere. Hydraulic actuators 
swivel the engine to produce pitch and yaw control torques. Roll control is 
maintained with the auxiliary propulsion system reaction jets. 

An Instrument Unit (IU) is located just ahead of the S-IVB stage. The 
IU contains a guidance computer, a data adapter, rate and lateral acceleration 
sensors, and a control computer that produces engine actuator command signals. 

The Apollo payload is a modular stack consisting of a Lunar Excursion 
Module adapter, a service module, a command module, and a launch escape 
system. The Apollo command module houses a three-man crew. Although the 
guidance and control system in the Apollo is primarily intended for postlaunch 
tasks, it can be used to monitor the launch vehicle flight. 


Wind Environment 

The wind environment is the primary external disturbance during the boost 
flight and is a major problem for the design of the Saturn first-stage vehicle 
control system. Two synthetic wind magnitude profiles were used for this 
study. These profiles (fig. 2) are based on statistical analysis of wind 
measurements taken at the Air Force Eastern Test Range, Cape Kennedy Launch 
Area. The two profiles, as indicated, have steady-state values that will not 
be exceeded 95 and 50 percent of the time, respectively, during the most windy 

month of the year at Kennedy Spaceflight 
Center. The accompanying vertical wind 
shear is not exceeded 99 percent of the 
same time period for both profiles. The 
peak value of wind shear occurs near the 
altitude corresponding to vehicle maximum 
dynamic pressure. A preliminary investi- 
gation showed that the small amplitude 
gusts discussed in reference 1 had little 
effect on the manual control problem. Two 
wind directions were found to have the 
greatest effect (ref. 1) : 135° and 225° 

relative to the vehicle launch heading. 



Figure 2.- Wind profiles. 
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Saturn I Guidance and Control System 

The guidance and control system that provides trajectory and attitude 
control from lift-off to payload separation is located in the Instrument Unit. 
Guidance command signals are provided by the Launch Vehicle Digital Computer 
shown in figure 3. During first -stage burn, the vehicle follows a pre- 
programmed open-loop tilt program to minimize aerodynamic loads during the 
high dynamic pressure portion of flight. During second -stage burn, the com- 
puter iteratively calculates command signals for a "minimum propellant" 
trajectory to previously stored aim conditions. 



Figure 3.- Block diagram of Saturn control system. 


During the Saturn I flight, the control law for the engine deflection 
angle, 0 C , is: 


S c = a 0 N o A<f) + a l N l‘j’ + § 2 n 2 Y 


CD 


where 

a Q attitude error feedback gain, deg/deg 
ai attitude rate feedback gain, deg/deg/sec 
g 2 normal acceleration feedback gain, deg/m/sec 2 
N 0 attitude error filter 

Ni attitude rate filter 

N 2 normal acceleration filter 
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Y normal acceleration, m/sec 2 
A<j> attitude error angle, deg 

cj> attitude angle rate, deg/sec 

Figure 3 indicates how this control law is implemented in the Saturn 
launch vehicles. An inertial platform located in the Instrument Unit provides 
attitude angles and acceleration measurements that are used by the launch 
vehicle digital computer to calculate an analog attitude error signal. This 
error signal and signals from rate gyros and normal accelerometers are fed 
into an analog Flight Control Computer. Each of the signals passes through 
the filters and gains shown in the figure and are then summed according to 
equation (1). The feedback gain variables, a 0 , ai, and g 2 , are not constant 
throughout the flight. They are adjusted to compensate for changing vehicle 
characteristics. During the Saturn I flight, a G and a^ are reduced in three 
steps at 10-second intervals starting at 100 seconds after lift-off. The 
normal acceleration gain, g 2 , varies as indicated in figure 4. The normal 
acceleration is used only during the portion of the flight where high dynamic 

The control computer on the Saturn 
I vehicle contains the passive networks 
mentioned earlier. The attitude error 
signal is filtered by a first-order 
time lag. The attitude rate signal 
passes through a second-order over 
fourth-order network designed to avoid 
excitation of the bending modes. Two 
time lags in tandem filter the 
accelerometer signal. 


pressure is encountered. 


<r 



FLIGHT TIME AFTER LIFT-OFF, sec 

Figure 4.- Accelerometer feedback gain variation. 


Flight Event Sequence 

An event sequence for the reference vehicle used for the simulation is 
shown in table I. This table introduces the three portions of flight that 
are significant for the flight-test program. The first part is the high 
dynamic pressure region of flight (high q) that starts near 60 seconds, 
reaches a peak near 70 seconds, and is essentially over by 100 seconds. As 
indicated during the wind profile description, the major control problem 
occurs during the high q part of the flight. The second portion of the 
flight is from 100 to 140 seconds and is suitable for doing altitude control 
and guidance display evaluation maneuvers. The feedback gain changes indi- 
cated in the table do not interfere with the maneuvers. The third part of 
flight occurs from 185 seconds, when the launch escape tower is jettisoned, 
to 350 seconds, when the attitude rate feedback gain reduction takes place. 
Perturbations which might be introduced by maneuvers done early in the second- 
stage flight can be eliminated by the iterative guidance system well in 
advance of orbit injection. 
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SIMULATION DESCRIPTION 


To subject the pilot to all the problem areas he may encounter during the 
actual flight, it was necessary to construct a flight simulation of the Saturn 
I-Apollo vehicle that could duplicate both normal and emergency situations. 

The elements simulated were the Saturn I vehicle dynamics and control system 
as well as the Apollo pilot's display and hand-rotational controller. The 
details of the Saturn I simulation given below are followed by a description 
of the fixed-base cab used to represent the Apollo command module. 


Saturn I Vehicle Simulation Model 

Separate simulations were used to model each of the two stages of the 
uprated Saturn I launch vehicle. The separate simulations eliminated the 
complexity that would be associated with the mechanization of staging opera- 
tions. The two sets of linearized equations used for the study represent the 
rotational and translational perturbations of the vehicle relative to a nom- 
inal trajectory. The details pertaining to the weight, thrust levels, flight- 
path programming, etc., were obtained from MSFC. 

The equations used for the first simulation included terms corresponding 
to both normal and emergency flight of the S-IB stage vehicle. The equations 
model the six-degree-of-freedom rigid-body dynamics, the gimbaled engines, 
the aerodynamic and trajectory environment, the first two flexible body bend- 
ing modes, and the control system feedback networks. An assessment of reli- 
ability constitutes a significant part of the study. Therefore, terms were 
added to model the vehicle behavior following system failures (actuators 
drifting hardover, loss of engine thrust, nonfunctioning sensors, instruments 
providing incorrect indications, etc.). 

The second-stage simulation was not as complex as the one used for the 
first -stage study. Structural bending problems are not significant during the 
S-IVB flight, and aerodynamic terms are negligible for a control system evalu- 
ation; therefore, both sets of terms were omitted from the simulation. On the 
other hand, the first liquid oxygen tank slosh mode is important and was 
included. A reliability analysis was not conducted for the second stage. The 
pilot can do nothing to compensate for failures involving the engine since 
the S-IVB stage has only one engine. Other failures, those associated with 
the control-system components or instruments, were easily recognized and over- 
come by the pilot during the first-stage studies. Therefore, it was assumed 
that there was no need to repeat this class of failures during the second- 
stage evaluation. A more detailed discussion of reliability considerations 
is given in a later section. 


Manual Control System Simulator 

The command pilot's station in the Apollo command module was modeled 
using a general purpose simulator cab. The cab contained an instrument panel. 
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a pilot's seat, and a three-axis rotational hand-controller, and the instru- 
ments and controller could be connected to the analog computer where the 
Saturn I simulation equations were solved. The cab arrangement is similar to 
the one described in reference 3. 


Figure 5 is a photograph of the flight simulator instrument panel display 
used for planning the flight experiment. Centered in the panel is a Flight 
Director Attitude Indicator incorporating a three-axis ball, cross needles. 



Figure S.- Simulator display panel. 


and side pointers. The total attitude angles (pitch, roll, and yaw) were dis- 
played on the ball. Pitch and yaw attitude error angles were presented on the 
left side and top pointers, respectively. The cross needles were used to dis- 
play various quantities. Pitch and yaw normal accelerations were displayed 
from lift-off through the high dynamic pressure region of flight. For the 
remainder of the first-stage flight, altitude error and altitude rate error 
were displayed. During the second-stage flight, the attitude error angles 
were displayed on the cross needles as well as on the side pointers. The 
altitude guidance presentation used after high q in the first-stage burn was 
also evaluated for the second-stage flight. 

Three attitude angle rate meters and a clock were grouped around the FDAI: 
pitch rate on the right, yaw rate below, roll rate on the lower left, and the 
clock on the left. A set of warning lights was placed in the lower right 
corner of the panel. These lights indicated which of the Saturn I engines 
were not thrusting. The light on the right of the horizontal row of lights 
indicated a launch vehicle inertial platform failure. The remaining lights 
were not used. 

Stability augmentation switches were mounted on the lower left side of 
the instrument panel. During the simulation studies, the pilot could open a 
feedback path, that is, do the equivalent of setting a Q , a* , or g 2 to zero 
on any axis by moving the appropriate switch to the up position. 

A rotational hand-controller, representative of the ones used in the 
Apollo command module, was mounted on the right arm of the pilot's seat. The 
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Figure 6.- Three-axis rotational controller. 


hand-controller used for the study 
is shown in figure 6. The handle 
is pivoted about an axis which 
permits forward and aft motion in 
the presence of longitudinal 
acceleration without introducing 
inadvertent attitude commands to 
the simulated vehicle. A roll 
command is generated when the con- 
troller handle is rolled right or 
left. A pitch command results 
when the handle is raised up or 
pushed down. A yaw command is 
generated when the handle is yawed 
right or left. Signals to the 
analog computer are generated by 
strain gages contained in flexure 
mounts . 


HANDLING QUALITIES STUDIES 


The handling qualities studies were undertaken to select a manual control 
system suitable for the in-flight experiment aboard the Saturn I launch vehi- 
cle. The control law adopted for these studies was chosen on the basis of the 
studies reported in references 1 to 3. This control law is similar to 
equation (1) and has the following form: 

e c = + a i N ^ + Wp (2) 

where 


ap pilot's rotational controller gain, deg/deg 
Np rotational controller filter 

6p output signal from pilot's rotational controller, deg 

The pilot's rotational controller input is essentially a trim signal intro- 
duced only to compensate for unusual flight conditions. So long as the flight 
proceeds normally, the pilot takes no control action. But in the event of 
excessive wind shears or a failure in the Saturn I flight control system, the 
pilot can supply a corrective command signal. 

The parameters varied during the handling qualities studies were: 
pilot's rotational controller gain, a p , cutoff frequency of the filter on the 
output of the rotational controller, the attitude error feedback gain, a 0 , 
and the attitude rate feedback gain, a \ . The attitude error and attitude rate 
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filter parameters were not varied. The handling qualities studies were 
carried out for both stages and will be discussed separately. 


The Cooper rating scale was the performance measure used for the studies. 
The Cooper rating scale was proposed in 1957 (ref. 5) and is shown here in 
figure 7. This rating is the pilot’s subjective opinion of how well he was 
able to control the vehicle with respect to some assigned task. 



ADJECTIVE 

RATING 


Satisfactory 


Unsatisfactory 


Unacceptable 


NUMERlCAL| nfrc;r | PRIMARY MISSION I CAN 

RATING |^IKIPTIQN| ACCOMPLISHED ? |BE LANDED 


1 Excellent, includes optimum Yes 

2 Good, pleasont to fly Yes 

3 Satisfactory, but with some 

mildly unpleasant characteristics Yes 

4 Acceptable, but with unpleasant 

characteristics Yes 

5 Unacceptable for normol 

operation Doubtful 

6 Acceptable for emergency 

condition only * Doubtful 


Yes 

Yes 

Yes 


■:vx«ooo< 


Yes 

Yes 

Yes 


7 Unacceptable even for emergency 

condition* No Doubtful 

8 Unacceptable - dangerous No No 

9 Unacceptable - uncontrollable No No 

10 Serious doubt of escape 


•(Failure of a stability augmenter) 


Figure 7.- Pilot rating scale. 


The following evaluation proce- 
dure was used for the handling qual- 
ities studies by the two Ames 
research pilots who participated. 

Each pilot flew a new situation 
as many times as he deemed necessary 
to acquire familiarity. When satis- 
fied that he had developed the 
appropriate technique, three data 
runs were taken. At the conclusion 
of the last run, the pilot gave his 
opinion as a number from figure 7. 

In addition, he often added spe- 
cific comments about unusual features 
of the run. 


Handling Qualities Study for S-IB Stage 

Two problems must be considered in defining the S-IB stage manual con- 
trol experiment. The first problem is high structural loading caused by wind 
shears and velocities that produce an angle of attack and a corresponding 
increase in lateral aerodynamic loads on the nose of the vehicle. These 
loads produce sizable bending moments and also rotate the nose of the launch 
vehicle away from the relative wind. The control system senses this rotation 
and sends a command to the engine actuators to reduce angle of attack by 
rotating the aft end of the vehicle away from the wind. Unfortunately, the 
thrust component that reduces angle of attack also increases the bending 
moment. A well-designed control system will use only small actuator deflec- 
tions to turn the vehicle, with the result that the bending caused by the com- 
bination of aerodynamic and control action moments is minimized. Another 
complication is that the control action that reduces bending moments by head- 
ing the nose of the vehicle into the relative wind also causes the vehicle to 
deviate from the planned flight path. In the Saturn I control system 
described earlier (eq. (1)), the normal acceleration term in the control law, 
g 2 N 2 Y, is introduced to suppress structural loads and at the same time to keep 
the vehicle near the planned flight path. For the handling qualities study, 
the pilot was assumed to be capable of initiating control action to alleviate 
structural loads. Therefore, the normal acceleration term was eliminated from 
the control law. 


Failure situations constitute the second major problem associated with 
the first-stage flight. Among the failures that can occur, one of the most 
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critical to control system operation is a double actuator failure which is 
introduced in such a way that the nose of the launch vehicle is turned into a 
relative wind. 


A hypothetical combination of events was used as the representative prob- 
lem for the first-stage handling qualities study. A double actuator failure 
at 75 seconds after launch was combined with a maximum wind profile that peaks 
at 70 seconds. The actuators were failed in a direction that made the com- 
bined aerodynamic and control moments a maximum. This combination of events 
constitutes one of the most severe situations that can occur during first- 
stage flight. 

Specific tasks were assigned to the pilot. He was to maintain attitude 
and minimize bending moments. In addition, control actions were to be smooth 
so the bending modes would not be excited. 

The pilot used variables displayed to him on the Flight Director Attitude 
Indicator to decide on control actions needed to fly the Saturn I. The pri- 
mary display variables were the attitude error angle and normal acceleration. 
The pilot interpreted the normal acceleration indication as a measure of angle 
of attack. His response to a gradual buildup of normal acceleration was a 
rotational controller command to turn the launch vehicle into the relative 
wind without allowing large attitude errors to develop. A rapid increase in 
normal acceleration and attitude error was a cue that a double actuator fail- 
ure had occurred. To compensate, the pilot generated controller signals that 
rotated the three good engines to bias positions to counter the torque pro- 
duced by the failed actuators. The succeeding rotational controller commands 
used to continue the flight were perturbations about the bias command. 


A preliminary part of the simulator study involved selecting the pilot's 
controller gain called "control authority." Control authority is the magni- 
tude (expressed in radians) of the command signal to the engine actuators when 
the pilot's rotational controller is fully deflected. Figure 8 shows how the 
pilot rating varied with control authority for the pitch and yaw axes. The 
lowest control authority acceptable (i.e., with a pilot rating of 3) to both 

pilots was 0.2 radian. Control authority 
for the roll axis was selected from a 
similar study and was set at 0.125 radian. 



Figure 8.- Pilot rating as a function of control 
authority for the pitch and yaw axes, S-IB 
stage . 


The output of the pilot's rotational 
controller was filtered to prevent exci- 
tation of the bending modes caused by 
the high frequency content of pilot com- 
mands. The first bending mode of the 
Saturn I has a natural frequency of 
approximately 9 rad/sec, which is above 
the frequencies the pilot generates 
intentionally in controlling the vehicle. 
Therefore, a simple first-order low-pass 
filter was studied for possible use on 
the output of the pilot's rotational con- 
troller. Several filter cutoff 
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frequencies ranging from 4 to 8 rad/sec were considered. Additional runs were 
made with the filter omitted. At filter cutoff frequencies below 5 rad/sec, 
the filter caused a minor degradation in the pilot's ability to control the 
vehicle. At filter cutoff frequencies above 5 rad/sec as well as with the 
filter entirely omitted, no significant change in pilot opinion was recorded. 
The electrical noise from the controller caused some excitation of the second 
bending mode when the filter was omitted. Since there may be noise associated 
with the Apollo system, a filter of at least first order should be used on the 
output of the controller. An adequate filter already available in the Saturn 
I Flight Control Computer is the attitude error filter, which has a cutoff 
frequency of from 5.6 to 5.8 rad/sec. Therefore, for a flight experiment, the 
attitude error and pilot's controller output signals would be summed ahead of 
the attitude error filter in the Flight Control Computer. This configuration 
was used for the remainder of the simulation study. 

An analytical investigation of the launch vehicle dynamics was conducted 
using a Laplace transform analysis. This study resulted in plots in terms of 
the complex frequency operator s = a + jto of the characteristic equation 
root locations for the S-IB stage. The root locations shown in figure 9 are 
for a representative time of flight, 60 seconds after lift-off, and for the 
attitude error and attitude rate feedback gain settings planned for a typical 
Saturn I flight. The roots most strongly affected by changing feedback gains 
are those associated with the rigid body motion. So long as 0 < a Q < 2 and 
0.5 < 3l\ < 1.8 the other roots remain close to the locations shown in the 

figure. When 2 < a Q < 3 and 1.8 < a\ < 3, the low frequency roots associated 

with the attitude error and attitude rate networks and the rigid body vary in 
location with variations of feedback gain settings . The higher frequency 
roots associated with the attitude rate network and all of the roots associ- 
ated with the engine, the bending modes, and the trajectory are insensitive 
to gain settings, a Q and aj, of less than 3. 

Handling qualities curves for the S-IB stage are shown in figure 10. The 
heavy lines are profiles of constant pilot opinion using the scale of figure 7. 

The other lines are profiles of rigid-body natural frequency and damping 

obtained from the characteristic equation evaluated at difference values of 
a Q and a^ . The pilot opinion ratings were related to the dynamics of the 




Figure 9.- Roots of S-IB characteristic equation Figure 10.- Pilot rating curves, S-IB stage, 

at T = 60 sec. 
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rigid body, which may be considered a second-order dynamical plant. The 
region inside the 3-1/2 and 4 rating contours indicates that a wide range of 
values for a Q and a^ are acceptable to the pilots. The gain settings used 
for the Saturn I vehicle first-stage flight are in the most acceptable region 
of the figure as indicated by the square data symbol. Significantly, the 
pilots do not regard low values of a Q unacceptable so long as adequate atti- 
tude rate feedback augmentation is provided. When a Q < 2 and a\ is above 
1.5, the rigid-body roots are real and the vehicle behaves primarily as a time 
constant. With large values of ai , the response is sluggish and more control 
authority is desired. The low rigid body damping associated with a Q < 1 and 
ai < 0.8 is reflected by increasing values of pilot rating. In the upper 
right region of the figure, the pilot opinion is influenced by the dynamics 
associated with both the rigid-body and the low-frequency roots of the atti- 
tude rate and attitude error feedback networks. The pilots were essentially 
attempting to control a system with fourth-order dynamics. Their main comment 
was that control authority was inadequate. 


Handling Qualities Study for S-IVB Stage 

The control problem for the second stage is to maintain the launch vehi- 
cle at the attitude angle commanded by the iterative guidance system. Since 
the S-IVB bum takes place above the atmosphere, aerodynamic forces and 
moments are negligible. The absence of external disturbing forces makes the 
second-stage burn time ideal for performing the flight experiment maneuvers. 

Two maneuvers were used for determining the handling qualities of the 
S-IVB stage for various a Q and a\ gain settings. In the sense of the maxi- 
mum attitude rate produced, the two maneuvers simulate the load relief and 
double actuator failure problems of the first stage. 

The first maneuver is diagrammed in figure 11 and is called a "step." 

It results in an average maximum attitude rate near 0.04 rad/sec, which is 
typical of a double actuator failure. The pilot changes attitude error from 
0° to 3° as smoothly and quickly as possible without excessive overshoot . The 
error is held for 15 seconds, then the vehicle is rotated in the opposite 
direction . 

The other maneuver is the "ramp" shown in figure 12 which results in a 
maximum rate of 0.01 rad/sec and simulates a load relief problem. The 
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Figure 11.- Maneuver that simulates double actuator Figure 12.- Maneuver that simulates load relief, 

failure . 
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maneuver is started with a 5-second buildup to 1.5° of attitude error. The 
error is held for 5 seconds, then the ramp direction is reversed until 1.5° 
of attitude error of the opposite sign is achieved. Five-second intervals 
were chosen because these are increments that the pilot can easily monitor on 
a round clock. 


The pilot used the attitude error signals displayed on the Flight 
Director Attitude Indicator cross needles to perform coordinated pitch and yaw 
maneuvers. The maneuvers were initiated with controller commands which caused 
the vehicle to pitch down and to yaw to the right. The pilot views this 
motion as pitch needle motion upward and yaw needle motion to the left. In 
terms of instrument indications, the intersection of the needles moved along 
a 45° line marked on the face of the Flight Director Attitude Indicator as the 
maneuvers were performed. 

The two maneuvers were run in sequence; the step was initiated at 
3 minutes after lift-off (approximately 30 sec into second-stage flight) and 
the ramp was initiated at 4 minutes into the flight. The pilots rated the 
maneuvers separately. 

Control authority for the pitch and yaw axes was evaluated for two sets 
of feedback gains: nominal (a Q = 0.56, a^ = 0.9) and reduced (a Q = 0, 
a.\ = 0.3). The data from the evaluation are shown in figure 13. Control 
authority is preferably a constant that does not influence pilot rating as 
attitude and attitude rate feedback gains are varied. But, it is clear from 
figure 13 that no single constant will be entirely adequate for all of the 
range of control authority investigated. The choice of a control authority 
of 0.07 radian was acceptable for most of the feedback gain settings and was 
therefore used for the handling qualities study. 


Roll control for the S-IVB stage is maintained with on-off reaction jets 
that are activated whenever the input command exceeds a preset value . As long 
as the pilot can generate a rotational controller signal exceeding the preset 
value, it does not matter what control authority is used. To avoid switching 
control authority at first-stage separation, a single setting (0.125 radian) 
was selected for both stages. 


The characteristic equation roots for the S-IVB stage vehicle dynamics 
and control system are shown in figure 14. The three sets of roots are for 
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Figure 14.- Roots of S-IVB characteristic 
equation. 
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the rigid body dynamics, the liquid oxygen slosh mode, and the attitude error 
compensation filter. Other roots such as rate networks, actuator dynamics and 
body bending modes are all at sufficiently high frequencies that they are not 
significant for the evaluation of vehicle handling qualities. The two sets 
of root locations shown in figure 14 indicate the dynamics 50 and 220 seconds 
after initiation of second-stage thrust. During a preliminary assessment, the 
pilots performed representative maneuvers during two time segments of flight. 
The pilots could easily accomplish the maneuvers when they were performed 
early in the second-stage flight. The dynamics in this time segment of flight 
are represented by the roots labeled 50 seconds in figure 14. The pilot's 
performance for the maneuvers done during the time segment beyond 200 seconds 
was poor. This poor performance is related to the gain reduction that takes 
place at 200 seconds and can be attributed to two factors. As shown by the 
roots labeled 220 seconds in figure 14, the damping of the rigid body is low. 
Simulator runs carried out for this region of flight indicate that, in addi- 
tion to the low rigid body damping, the slosh mode was evident and 
objectionable to the pilot. 

Representative maneuvers should be made early in the second-stage flight 
because of three factors. First, the vehicle control system dynamics are such 
that the maneuvers are most easily accomplished prior to the gain reduction 
which occurs at 200 seconds. Second, the iterative guidance system used dur- 
ing the S-IVB stage burn has ample time to eliminate trajectory errors that 
might have been introduced by the maneuvers. Third, the dynamics of the vehi- 
cle can be altered over wide ranges by varying a 0 and a^ from the values 
presently designed into the S-IVB control system. Thus, it is possible to 
simulate the dynamics at times in excess of 200 seconds by reducing the feed- 
back gains and doing maneuvers earlier in flight. 


The upper stage handling qualities plots are shown in figure 15. Equal 
ratings were usually recorded for step and ramp maneuvers; therefore, only 
one set of curves is presented. Superimposed on the handling qualities curves 
are profiles of rigid body frequency and damping. These profiles were deter- 
mined from the characteristic equation evaluated at 50 seconds into the S-IVB 
stage flight. The Saturn I control system feedback gains are indicated for 

50 and 220 seconds into the second- 



stage burn by the square and circle 
data symbols, respectively. 

The a Q - a\ plane contains 
three regions of interest. The first 
region is bounded on the left by the 
PR = 4 curve, on the right by the 
PR = 3 curve, and on the bottom by the 
ai axis. Here the pilot had no dif- 
ficulty in flying the maneuvers. 
Damping and control authority were 
acceptable; the slosh mode was 


unobservable on the cockpit displays. 


Figure 15.- Pilot rating for simulated actuator 
failure maneuver. 


The second region of interest lies to 
the left of the PR = 4 line where the 
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damping is poor. The pilot noticed the slosh mode and considered it objec- 
tionable in this region. The last region lies below the a x axis. The 
dynamics in this part of the plane are dominated by a single divergent root 
and are representative of a statically unstable vehicle. Small negative 
values of a Q pose no problem to the pilot. 


GUIDANCE STUDIES 


Techniques for manually guiding the upper stages of Saturn V into an 
earth orbit were developed during the studies conducted earlier (ref. 2). 

Some of these techniques were adopted for the Saturn I flight experiment 
study. The purpose of the present study was therefore more to select suitable 
guidance display type and scaling rather than to develop guidance techniques. 

The displays chosen for the guidance studies utilize the cross needles 
which are part of the Flight Director Attitude Indicators in the Apollo com- 
mand module. The variables used for the study were the altitude error and the 
altitude rate error, which represent the difference between the actual flight 
path and the nominal pitch program. Two display formats were investigated. 

For the first of these, a signal which was a linear combination of altitude 
error and altitude rate error (a 2 Ah + a 3 Ah) was used to drive the horizontal 
needle of the Flight Director Attitude Indicator. The vertical needle was 
inactive. The pilot's objective was to null the error signal. The second 
display, called a vector display, consisted of altitude error (Ah) registered 
on the vertical needle and the altitude rate error (Ah) registered on the hori- 
zontal needle. To null an error using the second format, the pilot first con- 
trolled the vehicle so that the needles intersected under a diagonal line 
marked on the face of the Flight Director Attitude Indicator. Positioning the 
needles on the diagonal was tantamount to selecting a ratio between Ah and 
Ah, that is, establishing a control law consisting of a linear combination of 
altitude error and altitude error rate feedback. Succeeding control action 
caused the vehicle reference to move to the needle intersection along the 
diagonal line to null the trajectory error. 

During a flight experiment, the primary guidance would be provided by 
a nominal gravity-turn pitch program during the first-stage burn and by the 
iterative guidance system during the second-stage burn. Three constraints 
influenced the study. First, a flight experiment must not interfere with the 
second-stage iterative guidance system. Second, during the high q portion 
of the first-stage flight, the vehicle must not fly at angles of attack that 
would compromise the structure. Third, the attitude rates about all three 
axes must be nulled prior to staging which occurs at 145 seconds. These three 
constraints resulted in a decision to start a guidance experiment at 100 
seconds into the flight and terminate it at 140 seconds. 

A standard procedure was used for the studies. The manual control system 
used for the study was described earlier by equation (2). It will be recalled 
that the attitude error and attitude rate feedback paths were retained but the 
accelerometer feedback was omitted. For the guidance studies, a maximum wind 
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profile was introduced as a disturbance function. During the simulated 
flights, the pilot took no corrective action until 100 seconds. This caused 
the vehicle to deviate from the nominal trajectory so that at 90 seconds the 
altitude error was 500 m and the altitude rate error was 20 m/sec. For the 
first 90 seconds of the flight, the Flight Director Attitude Indicator cross 
needles indicated normal acceleration to provide the pilot with a measure of 
structural loading. At 90 seconds, the inputs to the needles were changed 
from normal acceleration to guidance errors. The 10 seconds from 90 to 100 
seconds were used by the pilot to assimilate the guidance display information 
prior to taking over the guidance function. At 100 seconds, the pilot ini- 
tiated controller commands to reduce first-stage burnout errors subject to 
the constraint that attitude rates about all three axes were to be nulled at 
inboard engine cutoff. 

The evaluation procedure used by the pilots was the same as that used for 
the handling qualities studies; that is, the pilot practiced runs until satis- 
fied with his proficiency. Then, he flew three simulated runs for the record. 
Data recorded consisted of altitude and altitude rate errors measured at 
140 seconds and the pilot rating. 


Data from the guidance display evaluation are shown in figures 16 and 
17. During the studies, the altitude errors were presented so that 1 inch of 
needle deflection corresponded to 2000 m. Altitude rate errors were presented 
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Figure 16.- Pilot rating of a 2 Ah + a 3 Ah 
presentation . 


Figure 17.- Pilot rating of Ah and Ah 
presentation. 


with three different levels of scaling; 200, 100, and 50 m/sec/in. of needle 
deflection. In figures 16 and 17, the three levels of scaling are shown in 
terms of ratios identified in the following table. 



Altitude error 

Ratio 

m/in. 

10:1 

2000 

20:1 

2000 

40:1 

2000 


Altitude rate error, 
m/sec/in. 

200 

100 

50 


There was little variation in the pilot rating data for either display. 
Figure 16 indicates that, for the first display, the linear combination of 
altitude error and altitude rate error, the pilots considered all three ratios 
to be equally effective. The data for the second display shown in figure 17 
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indicate that ratios of 20:1 and 40:1 were favored over 10:1. No preferences 
between the two systems were noted during the guidance studies. However, 
later during the reliability assessment, which will be discussed in the next 
section, one of the pilots commented that the vector display was sometimes 
confusing. It did not seem natural to him to have an altitude indication dis- 
played on a vertical needle. There was little variation in the end-point dis- 
persion data for either display. The average trajectory error at inboard 
engine cutoff was 100 m and 7 m/sec. This compares to 800 m and 6 m/sec if 
the pilot made no guidance correction. 


RELIABILITY EVALUATION 


The purpose of the reliability evaluation was to show that mission reli- 
ability will not be impaired by the flight experiment modifications and pro- 
cedures. Since an extensive analysis had already been completed for the 
Saturn V (ref. 3 ) t only an abbreviated reliability analysis of the Saturn I 
was necessary to account for the differences between the two vehicles. The 
evaluation procedure given in reference 3 was adopted for the Saturn I study. 
Briefly, this procedure is: 

1. Define the system. 

2. Define major failure modes. 

3. Simulate system and failure modes. 

4. Define pilot procedures. 

5. Conduct simulation with random failures. 

6. Calculate probability of mission failures. 

The reliability study is discussed in the order listed above. 

The reliability analysis was conducted for only the first stage. The 
reasons for limiting the study to the first stage are summarized below. 

1. Structural loading associated with first-stage flight is a major 
concern in the design of the Saturn I control system. 

2. The peak dynamic pressure and the wind disturbances occur during the 
first- stage burn. 

3. The four gimbaled and controllable engines on the S-IB stage make it 
possible to compensate for most failures associated with a single engine. 

4. The results of the first -stage reliability study involving failures 
such as sensors or instruments are assumed to be applicable to the upper 
stage . 



For the reliability analysis, the control system feedback gains were 
set to a Q = 0.2, a^ = 1.65, and g 2 = 0. This gain configuration represents 
the minimum booster augmentation that would be proposed for a flight 
experiment . 


Failure Modes 

An assessment was made of the launch vehicle failure modes (as opposed 
to component failures) that could occur to interfere with the controllability 
of the Saturn I. The most critical of the failures and the corresponding 
probabilities of occurrence are listed in table II. Four of the failure modes 
listed were excluded from the simulation studies. Three of these (items 
14-16) were omitted because the probability of occurrence is negligibly small. 
The remaining failure, that is, one actuator null, was dropped because it 
represents a less severe problem to the pilot than the fully deflected 
actuator considered. 

Types of failures were combined with the following flight conditions to 
produce a test series of 82 simulated flights. The first-stage flight was 
divided into three time segments: before, during, and after high q. Two 

wind conditions, the 95- and 50-percent profiles, and the two wind directions, 
northwest and southwest, were considered. A single actuator could fail toward 
or away from the wind. A thrust or double actuator failure could occur to 
turn the launch vehicle into, out of, or perpendicular to the wind. There was 
no direction associated with the other failure modes (e.g., a rate gyro fail- 
ure) . An individual situation consisted of a combination of the region of 
flight when the failure occurred, the type of failure, and the direction of 
failure relative to the wind if more than one direction was possible. All 
situations were encountered at least once during the simulation series. Extra 
situations were included for those failures which have a high probability of 
occurrence. The number of simulated flights for each type of failure is 
listed in the last column of table II. 

During the Saturn V simulation studies (ref. 3), instrument display 
failures caused no mission failures. To verify this conclusion for the 
Saturn I, a limited number of instrument and accelerometer failures were 
introduced - items 8 through 13 in table II. 


* 


Pilot Procedures 

In the event of a system failure, the pilot first identified the problem. 
He then used the rotational hand controller to maintain the vehicle at or 
near nominal values. Different control techniques were needed for the 
various categories of failures. For hardware malfunctions in the launch 
vehicle control system (loss of inertial attitude, attitude rate, attitude 
error angle feedback, etc.), the pilot used information from sensors located 
in the spacecraft to stabilize and control the vehicle attitude. For example, 
a launch vehicle attitude rate loop malfunction (failure 6 in table II) caused 
the vehicle motions to become dynamically unstable. The pilot compensated 
for this failure by using the displayed rate information, which is sensed by 
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gyros located in the Apollo command module, to stabilize the vehicle motions. 

In the case of an engine actuator failure or loss of thrust, asymmetrical 
rotational moments were developed on the vehicle. To correct these situations, 
the pilot acted as an integration type element to inject trimming or bias 
commands which nulled the rotational moments caused by the failure. In the 
case of a single display failure, the instrument indications in the command 
module were sufficiently redundant that, by cross-checking, the pilot was able 
to detect which instrument had failed. He could continue to fly the vehicle 
using the remaining valid indications. 

On all flights in the series, the pilot used the normal acceleration 
indications up to 90 seconds to reduce the vehicle structural loading. At 
90 seconds, the Flight Director Attitude Indicator cross needles were switched 
to indicate altitude error and altitude rate error. The pilot used these 
guidance error indications to reduce miss distances at first-stage burnout. 


Simulation Procedure 

To compare manual and Saturn I fully automatic control system performance 
during failure, three sets of runs, each consisting of the 82 situations, were 
conducted. Two of these were with pilots flying the simulated launch vehicle 
using a manual control system, the third set was done with the Saturn I 
automatic control system. 

The pilots were exposed to failure situations in a randomly ordered 
sequence. Before each simulated flight, the pilot was briefed on wind direc- 
tion and magnitude. (This wind information is available to the astronauts 
prior to an actual flight.) 

For all situations except an engine out, the criterion for a successful 
mission is that the maximum normalized bending moment experienced during 
flight must not exceed unity. This normalized bending moment is expressed as 
the ratio of the maximum bending moment during the flight to the breakup bend- 
ing moment. So long as breakup did not occur, the vehicle was flown as near 
to the first-stage burnout aim point as the pilot could manage. Pilot rating, 
maximum bending moment, maximum attitude rate, and the burnout miss distance 
from the nominal trajectory were all used to judge how well the mission could 
be flown. The criterion for a successful engine-out flight was different. In 
this case, the mission was considered successful if the launch vehicle could 
be flown through high q without breaking up. Unless the engine failure 
occurred very late in flight, it would not be possible to stay near the 
nominal trajectory. 


Results of the Reliability Evaluation 

The results of the reliability analysis phase of the simulation studies 
are presented in three parts : the manual and Saturn I control system perform- 

ance for each failure; the impact of this performance on mission reliability; 
and the evaluation of trajectory dispersions. 
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Manual and Sat urn I control system performa nc e.- Figure 18 shows the 
maximum attitude rate, pilot rating, and maximum normalized bending moment 
for each type of failure listed in table II. The maximum and average values 
of each parameter are shown for the Saturn I control system and for both 
pilots. The first three columns show behavior in the presence of the 95 per- 
cent wind; the last three columns are for the 50 percent wind. 
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Figure 18.- Maximum pitch or yaw attitude rate, pilot rating, and maximum bending moment 

following various failures. 

The performance of the Saturn I automatic flight control system is indi- 
cated in the first (95-percent wind) and fourth (50-percent wind) columns of 
figure 18 for each failure type. The maximum normalized bending moment 
exceeded unity (vehicle breakup) during some of the loss of attitude rate 
feedback and all of the accelerometer-saturate situations. A third critical 
failure was two actuators hardover for which the bending moment reached 
0.95 for one situation. 

The pilot's performance is shown in the second and third columns 
(95-percent wind) and the fifth and sixth columns (50-percent wind) of the 
figure for each failure situation. None of the manually controlled missions 
were terminated by launch vehicle breakup. The pilots considered the two 
actuators hardover and loss of attitude rate feedback to be the most difficult 
to fly. Their maximum rating, 6-1/2, was given for the double-actuator fail- 
ure. Loss-of-attitude-rate-feedback failures were considered uniformly hard 
to fly; maximum pilot rating was 6 and the average was 5-1/2. The other 
failures were not troublesome. 


t 
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Certain of the reliability results from figure 18 are related to the 
handling quality studies described earlier. Recall that the representative 
problem used for the earlier evaluation included a double- actuator failure. 

The average pilot rating for the double actuator failures (fig. 18) is 5. 

This compares to a pilot rating of 4-1/2 in the first-stage handling qualities 
study. For the handling qualities study, the pilots knew what the failure was 
and when it would occur. But, for the reliability analysis, there was an 
additional element of surprise; the pilot did not know ahead of time when the 
failure would occur or what it would be. It is evident that the element of 
surprise is not critical since the results of the two study phases are in good 
agreement . 

The noncritical (instrument and accelerometer) failure flights are repre- 
sentative of normal missions. During these flights, the only disturbance 
applied to the vehicle was the wind profile. Average pilot ratings near 3 
were given for these flights . 

Another observation relates to the step maneuver used for the S-IVB stage 
handling qualities studies. In figure 18, the average value of the maximum 
attitude rates lies just below 0.4 rad/sec. The step maneuver, which also 
results in rates near 0.4 rad/sec, is therefore considered to provide the 
pilots with a problem approximately as demanding as a double-actuator failure. 

Mission reliability .- Criticality numbers calculated using the equations 
given in appendix A on data reduction procedures are shown in table III. A 
low probability of failure is associated with each of the types of failure 
for which the automatic control system could not complete the mission. There- 
fore, the total mission criticality numbers were small - 14><10 -6 for a 
95-percent wind and 7><10~ 6 for a 50-percent wind. 

No failures were recorded for the manual control system; hence, the total 
mission criticality number is zero. 

The data presented in figure 18 show that the pilots were always able to 
prevent aborted missions due to excessive structural loading. This is a 
better record of performance than was obtained for the Saturn V reliability 
study (ref. 3) where some situations resulted in launch vehicle breakup. The 
superior Saturn I record is attributable to at least two factors: structural 

strength of the Saturn I vehicle and level of pilot training. Because of the 
sample sizes of 82 cases, there may be situations other than those covered 
in the study that the pilots will be unable to fly. On the other hand, the 
Saturn I is shorter, stronger, and therefore easier to fly than the Saturn V. 
Because the pilots participated extensively in the Saturn V study and there- 
fore had a backlog of experience, they had only a short period of training on 
Saturn I failures (eight hours in addition to the time devoted to the handling 
qualities study). With more training, their ability to fly the missions would 
certainly improve. It is apparent that a Saturn I manual control system can 
provide acceptable reliability for the in-flight experiment. 

Trajectory dispersions .- After high q, the pilot was mainly concerned 
with reducing first-stage burnout dispersions. Any trajectory errors intro- 
duced in the flight-path (pitch) plane due to wind disturbances were nulled 


21 



during the final 40 seconds of flight with the aid of the guidance displays. 
Performance of the automatic control system and of each of the pilots is 
shown in figure 19, where the averages of the magnitudes of errors in alti- 
tude, altitude rate, lateral position, and lateral velocity are plotted. 
Representative dispersions are shown in the figure for all nonabort, single- 
actuator, double- actuator, and all instrument or accelerometer failures. 
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Figure 19.- Average dispersion errors at first stage burnout for various failures. 


The pilot's performance is notably better than that of the Saturn I 
control system. This is understandable for the pitch plane cases since the 
Saturn I control system nulled only attitude and attitude rate errors; no 
feedback paths existed in the control system for nulling trajectory errors. 

On the other hand, the pilots had attitude, attitude rate, altitude, and 
altitude rate displays so they could manually provide a guidance feedback 
path. Their success in controlling the altitude dispersions is demonstrated 
in the figure. 

The pilots also performed well in nulling lateral dispersions, especially 
for engine actuator failures where a large attitude torque bias exists on the 
vehicle. By acting as an integration type element (biasing the pilot's hand 
controller) the pilot was able to maintain close attitude control. Even 
though lateral dispersion data were not displayed to the pilot, the lateral 
dispersions for the piloted flights were considerably smaller than for the 
flights with automatic control. 
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CONCLUSIONS 


The following conclusions were drawn from the simulation study of the 
Saturn I manual control system. 

1. The display variables required by the pilot are related to the mis- 
sion task. For the load relief task the pilot needs indications of attitude 
error and structural loading. Structural loading information can be in the 
form of normal acceleration measured at the Instrument Unit of the Saturn I 
or it can be angle of attack sensed at the nose of the launch vehicle. Vari- 
ables which are important for the guidance experiments are altitude error, 
altitude rate error, and attitude error. Attitude error, attitude rate error, 
normal acceleration (angle of attack) , altitude error, and altitude rate error 
displays are all needed if a failure occurs since they are aids for continuing 
the flight if continuation is possible. Attitude rate error is primarily an 
indication of impending catastrophic failure and is of secondary interest for 
flying the launch vehicle. 

2. There is considerable latitude in the choice of feedback gains for 
the manual control system. The acceleration feedback loop of the Saturn I 
control system can be omitted when the vehicle is under manual control. Atti- 
tude error feedback (a ) can be significantly reduced. Attitude rate feedback 
(aj) must be maintained at or near the MSFC design level. So long as attitude 
rate feedback compensation is provided, the pilots regard the handling 
qualities as adequate. 

3. Attitude maneuvers can be conducted in the early portion of the S-IVB 
stage flight without causing significant trajectory perturbations. 

4. The type of display and the scaling over the range studied do not 
influence the pilot's ability to complete the guidance task provided the dis- 
play indicates altitude error and altitude rate error and provided guidance 
is the only task assigned to the pilot. 

5. The simulation studies indicate that the addition of a manual control 
system to the Saturn I will improve the reliability of the launch vehicle. 


Ames Research Center 

National Aeronautics and Space Administration 

Moffett Field, Calif., 94035, Nov. 22, 1968 
125-19-01-39-00-21 
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APPENDIX A 


DATA REDUCTION PROCEDURE FOR THE RELIABILITY ANALYSIS 


The basic laws of probability needed to compute the reliability of the 
Saturn I manually controlled booster are written in concise form in refer- 
ence 6. These laws are expressed in terms of two events, A and B, that have 
occurred during a hypothetical experiment. The probability of A occurring is 
written P(A) which is the number of times that A occurred divided by the 
total number of trials. The probability associated with event B is P(B). 
The event that both A and B occur is written AB. The associated probabil- 
ity is P(AB). The probability that either A or B or both occur is written 
P(A + B) . The following relation can be deduced: 

P (A + B) = P (A) + P (B) - P (AB) (Al) 

If A and B are mutually exclusive, that is, A and B do not occur together, 
then P (AB) in equation (Al) is zero and P(A + B) is the sum of P (A) and 
P(B). 


The probability that A occurs, given that B has occurred, is called 
a "conditional probability" (also "effectivity number") and is written as 
P(A/B). It can be shown that 


P (AB) = P(B) P (A/B) (A2) 

For the specific launch vehicle experiment - the introduction of random 
failures as the pilot flies the booster simulation - the following definitions 
and assumptions are established. Denote a launch vehicle failure event by the 
symbol F and associated probability of failure by P(F). A type of failure - 
one of those listed in table II - is given the symbol and associated 

probability of occurrence, P(Cj_). It is assumed that the P(C^) can be pre- 
dicted by a Poisson process. That is, once the components are installed, 
operated long enough to eliminate manufacturing failures, and tested, the suc- 
ceeding probability of failure is proportional to the time the component is 
operated. Since the P(C^) for all the types of failures are small numbers, 
the probability that more than one failure will occur during a flight is con- 
sidered negligibly small. For present purposes, the types of failures are 
essentially mutually exclusive. 

The probability that the mission will fail if one of the types of fail- 
ures occurs is called the "criticality number," and is denoted by P(FC^). 

From equation (A2), 

P(FCi) = P(C i )P(F/C i ) (A3) 

The probability that the vehicle will fail, given that a type of failure has 
occurred, P(F/C^), is obtained from the simulation experiment. For example, 
if a pilot flew three missions with a given type of failure and could complete 
only two of the missions, P(F/Ci) would be 1/3. 
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Since an unequal number of situations were flown in each of the three 
time segments, two properties - independent events and reliability defined by 
the Poisson process - were applied to arrive at the component criticality num- 
ber. First, the criticality numbers for each of the time segments (0-60 sec, 
60-100 sec, and 100-140 sec) are mutually exclusive and can therefore be 
directly summed: 


P(FCi) 


P(FCi) 0 _ 60 + P(FCi) 


60-100 


+ P(FC i ) 1 


00-140 


(A4) 


The probability of a component failure for a Poisson process is written as 


PCCp) = gAt 


(A5) 


where 3 is the number of failures per million flights per unit of time. 

The time interval. At, is the length of the flight, 140 seconds for the S-IB 
stage. To determine the probability of a component failure in each of the 
time segments, P(CjJ is multiplied by the ratio of time in the segment 
divided by the length of the flight: 


and 


P(Ci ) 0 _ 60 - P(Ci) 


60 

140 


P ^ C i^60-100 P ^ C i^l00-140 “ P ( C i) 


40 

140 


(A6) 


Taking equations (A3) and (A6) into account, equation (A4) becomes 


P(FCi) 



(A7) 


Finally, since each failure is treated as mutually exclusive, the total criti- 
cality number is the sum of the criticality numbers for each type of failure. 


An example pertaining to the automatically controlled S-IB stage follows. 
With a 95-percent wind, a total of three loss-of-attitude-rate-feedback simu- 
lated flights were flown, one in each time segment. From table II, P(C 6 ) is 
17*10~ 6 . When the booster was under automatic control, the booster broke up 
following failures which occurred before and during high q. Therefore, 
P ( C 6 )o -60 = 1 » P ( F / C 6 ) 60-100 = and P (P/^ 6 ) 100-140 = 11 follows that 

the criticality number for item 6 is 


(FCk) = 


(A8) 


The criticality numbers 


for all of the failure 


types are 


listed in table III. 
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TABLE I.- EVENT SEQUENCE FOR SATURN I 


Flight time, sec 

Event 


S-IVB 

S- IB 

0 


Lift-off 

60 


Initiation of high q 

70 


Maximum q for simulation 

100 

110.0 

120.0 


Attitude and rate feedback 


gain changes 

141.4 


Inboard engine cutoff 

144.40 


Outboard engine cutoff 

145.28 


Physical separation 

146.6 

-3.3 

S-IVB engine start command 

149.9 

.0 

S-IVB 90-percent thrust 

157. 2 

7.3 

Ullage jettison 

184.4 

34.5 

Launch escape tower jettison 

349.9 

200.0 

Attitude rate feedback gain 



reduction 

476.9 

327.0 

Mixture ratio change 

600.48 

440.58 

S-IVB engine cutoff command 


TABLE II.- FAILURE MODES 


Failure 

number 

Type of failure 

Probability of 
failure x 10 6 

Number of 
simulated flights 

1 

One actuator hardover 

11,161 

18 

2 

Loss of thrust 

5,000 (Est.) 

13 

3 

Two actuators hardover 

10,200 

13 

4 

Loss of inertial 




attitude 

2,035 

5 

5 

One actuator 




oscillatory 

156 

5 

6 

Loss of attitude rate 




feedback 

17 

5 

7 

Loss of attitude 




feedback 

17 

5 

8 

Accelerometer saturate 

6 

2 

9 

Accelerometer null 

95 

4 

10 

Attitude error display 




failure 

* 

4 

11 

Attitude rate display 




failure 

* 

3 

12 

Accelerometer display 




failure 

★ 

3 

13 

Inertial attitude 




display failure 

* 

2 

14 

Saturation of inertial 


0 


attitude 

* * 

15 

Saturation of inertial 


0 


attitude error 

3 

16 

Saturation of attitude 


0 


rate 

<1 

17 

One actuator null 

28 

0 

Total number of simulated flights 

82 


*No information available. 

**The inertial platform is buffered by the redundant Launch 
Vehicle Data Adapter. Reasonableness checks are made 
and saturated failures are not permitted. 



TABLE III.- MISSION CRITICALITY ESTIMATE 


Fai lure 
number 


Probability 

Criticality x 10 6 

Type of failure 

of failure 

95-percent 

50-percent 


x 10 6 

wind 

wind 




Auto 

Piloted 

Auto 

Piloted 

1 

One actuator hardover 

11,161 

0 

0 

0 

0 

2 

Loss of thrust 

5,000 (Est.) 

0 

0 

0 

0 

3 

Two actuators 







hardover 

10,200 

0 

0 

0 

0 

4 

Loss of inertial 







attitude 

2,035 

0 

0 

0 

0 

5 

One actuator 






6 

oscillatory 
Loss of attitude 

156 

0 

0 

0 

0 


rate feedback 

17 

12.2 

0 

7.3 

0 

7 

Loss of attitude 







feedback 

17 

0 

0 

0 

0 

8 

Accelerometer 







saturate 

6 

1.7 

0 

0 

0 

9 

Accelerometer null 

95 

0 

0 

0 

0 

10 

Attitude error 






11 

display failure 
Attitude rate 

* 

- 

0 

- 

0 

12 

display failure 
Acce lerometer 

* 

- 

0 

- 

0 


display failure 

•k 

- 

0 

- 

0 

13 

Inertial attitude 
display failure 

■k 

_ 

0 


0 

Total mission criticality 

14 

0 

7 

0 


*Not applicable. 


Definition of criticality: Probability that the mission will fail if one 

of the types of failure occurs. 
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